Productivity Suite CVE-2025-58456

Exploitation requires network reachability to the ProductivityService PLC simulator component of AutomationDirect Productivity Suite 4.4.1.19, and that simulator must be running/exposed - reflected by the CVSS 4.0 AT:P (Attack Requirements: Present) metric, so this is not guaranteed against every install. No authentication is required (PR:N) and no user interaction is needed (UI:N). The limiting factor is the simulator's exposure: if the ProductivityService simulator is not active or is not network-accessible (e.g., isolated engineering workstation, segmented OT network), the attack surface is absent. Impact is confined to reading arbitrary files (confidentiality); it does not by itself alter PLC logic or cause downtime.

Signals are moderate and largely consistent rather than alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated, low-complexity attack, but the AT:P (Attack Requirements: Present) metric is important: successful exploitation depends on a specific precondition - the ProductivityService PLC simulator being active/reachable - which is not a guaranteed default state. Impact is scoped to confidentiality (VC:H, arbitrary file read) with no integrity or availability effect (VI:N/VA:N) and only minor subsequent-system confidentiality impact (SC:L), so this is a disclosure flaw, not remote code execution or control manipulation. EPSS is low at 0.62% (49th percentile), the CVE is NOT on CISA KEV, and no public POC is referenced - so there is no evidence of active exploitation or a widely available exploit. The vulnerability is credible and vendor/ICS-CERT-acknowledged, but it is best characterized as a medium-real-risk file-disclosure issue in niche OT engineering software rather than a mass-exploitation priority. Note the AT:P requirement in CVSS 4.0 has no clean CVSS 3.1 equivalent; teams translating this to 3.1 should decide whether to raise attack complexity to reflect the simulator precondition.

An attacker with network access to a host running the AutomationDirect Productivity Suite reaches the exposed ProductivityService PLC simulator and sends crafted requests containing relative path traversal sequences (e.g., ../../) to escape the intended directory. Because no authentication is required, the attacker reads arbitrary files on the target machine, potentially harvesting configuration, credentials, or project/PLC files. No public exploit is identified at time of analysis, and exploitation depends on the simulator service being running and reachable.